Version: 2026-10
This Data Processing Agreement ("DPA") is between Trackabeast, Inc., a California corporation, 1304 Josephine St., #2, Berkeley, CA 94703, USA, support@trackabeast.com ("Trackabeast", the "Processor"), and the organisation that accepts it when using Trackabeast (the "Customer", the "Controller"). It forms part of the agreement under which Trackabeast provides its animal rescue management software to the Customer (the "Service Agreement"), and applies whenever Trackabeast processes personal data for the Customer that is subject to the EU General Data Protection Regulation 2016/679 ("GDPR") or the UK GDPR.
1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.
1.2 "Customer Personal Data" means the personal data that the Customer or its users enter into, upload to, or collect through Trackabeast, including through Trackabeast-hosted application forms, as described in Annex I.
1.3 "Sub-processor" means another processor engaged by Trackabeast to process Customer Personal Data.
1.4 "SCCs" means the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
1.5 This DPA does not cover personal data for which Trackabeast is itself the controller, such as the Customer's billing contacts and its users' login accounts. The Trackabeast Privacy Policy describes that processing.
2.1 The Customer is the controller and Trackabeast is the processor of Customer Personal Data.
2.2 Trackabeast processes Customer Personal Data only on the Customer's documented instructions. The Service Agreement, this DPA, and the Customer's use and configuration of Trackabeast (including turning on integrations such as Petfinder, RescueGroups.org or microchip registries) are the Customer's instructions. Trackabeast may also process Customer Personal Data where EU or Member State law requires it, and will tell the Customer first unless that law forbids it.
2.3 Trackabeast will tell the Customer promptly if it believes an instruction breaks the GDPR.
2.4 The Customer is responsible for having a lawful basis for the data it collects, for giving data subjects the required information, and for the accuracy of the data it enters.
Trackabeast gives access to Customer Personal Data only to the people who need it to provide, support or secure the service. Each of them is bound by a duty of confidentiality, by contract or by law.
4.1 Trackabeast maintains the technical and organisational measures in Annex II, which are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (GDPR Art. 32).
4.2 Trackabeast may change these measures over time, but not in a way that lowers the overall level of protection.
5.1 The Customer gives Trackabeast general authorisation to use Sub-processors. The current Sub-processors are listed in Annex III.
5.2 Trackabeast will email the Customer at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the Service Agreement and receive a refund of any prepaid fees for the unused period.
5.3 Trackabeast will bind each Sub-processor by written contract to data protection obligations at least as protective as this DPA, and remains responsible to the Customer for its Sub-processors.
5.4 Services the Customer chooses to connect, such as Petfinder, RescueGroups.org, BuddyID, Petlink or AKC Reunite, are not Sub-processors. Trackabeast sends them data on the Customer's instruction, and the Customer's own terms with them apply.
6.1 Data subject requests. Most requests can be handled by the Customer directly in Trackabeast, by viewing, correcting, exporting or deleting records. Where that is not enough, Trackabeast will help the Customer answer requests to access, correct, erase, restrict, port or object to processing. If a data subject contacts Trackabeast directly, Trackabeast will pass the request to the Customer without undue delay and will not answer it itself unless the Customer asks.
6.2 Other obligations. Taking into account the information available to it, Trackabeast will give reasonable help with the Customer's security obligations, data protection impact assessments and prior consultations with a supervisory authority (GDPR Art. 32 to 36).
7.1 Trackabeast will notify the Customer without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
7.2 The notice will describe, as far as then known, what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the steps taken or proposed. Trackabeast will send further information as it becomes available.
7.3 Trackabeast will take reasonable steps to contain the breach and reduce its effects. The Customer decides whether to notify its supervisory authority and data subjects, and Trackabeast will help it do so.
8.1 For 90 days after the Customer's account is closed, the Customer can still log in to download its records, and can email support@trackabeast.com to receive a copy of its uploaded files and pictures.
8.2 At the end of those 90 days, Trackabeast permanently deletes all Customer Personal Data from its live systems. Copies in database backups are overwritten within a further 30 days, and deleted files are permanently removed from file storage within 30 days.
8.3 Trackabeast may keep Customer Personal Data longer only where EU or Member State law requires it, and will keep it confidential and process it only for that purpose.
9.1 Trackabeast will make available to the Customer the information reasonably needed to show compliance with this DPA and GDPR Art. 28, including written answers to security questionnaires.
9.2 If that information is not enough, or a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality. The Customer will give at least 30 days' notice, limit the audit to once a year unless a breach has occurred, and bear its own costs.
10.1 Trackabeast is in the United States, and Customer Personal Data is stored and processed on servers in the United States (see Annex III). For transfers of Customer Personal Data from the European Economic Area to Trackabeast, the parties enter into the SCCs, Module Two (controller to processor), which are incorporated into this DPA by reference. The Customer is the "data exporter" and Trackabeast is the "data importer".
10.2 The parties make these choices in the SCCs:
| SCC clause | Choice |
|---|---|
| Clause 7 (docking clause) | Included |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation, with 30 days' notice of changes as in section 5 |
| Clause 11(a) (independent dispute resolution body) | Optional wording not included |
| Clause 13 (supervisory authority) | The supervisory authority of the EU Member State where the Customer is established |
| Clause 17 (governing law) | Option 1, the law of the EU Member State where the Customer is established |
| Clause 18(b) (courts) | The courts of the EU Member State where the Customer is established |
| Annex I.A (parties) | The parties named at the start of this DPA |
| Annex I.B (description of transfer) | Annex I of this DPA |
| Annex I.C (competent supervisory authority) | As under Clause 13 |
| Annex II (security measures) | Annex II of this DPA |
| Annex III (sub-processors) | Annex III of this DPA |
10.3 If the SCCs and this DPA conflict, the SCCs prevail.
10.4 Trackabeast has assessed the laws of the United States that apply to it and has no reason to believe they prevent it from meeting its obligations under the SCCs (Clause 14). If Trackabeast receives a government request for Customer Personal Data, it will tell the Customer where the law allows and challenge the request where there are reasonable grounds (Clause 15).
11.1 Term. This DPA lasts as long as Trackabeast processes Customer Personal Data, including the 90-day period in section 8.
11.2 Liability. Except where the GDPR or the SCCs do not allow it, each party's total liability under this DPA is limited to the fees the Customer paid Trackabeast in the 12 months before the claim.
11.3 Order of precedence. If documents conflict, the SCCs prevail, then this DPA, then the Service Agreement.
11.4 Governing law. Apart from the SCCs, which are governed as set out in section 10, this DPA is governed by the laws of the State of California, USA.
11.5 Changes. Trackabeast may update this DPA to reflect changes in law or in its Sub-processors, with notice as in section 5. Other changes need both parties' agreement.
11.6 Acceptance. The Customer accepts this DPA when one of its administrators clicks "I agree" in Trackabeast. Trackabeast keeps a record of who accepted, when, and which version.
| Data subjects | The people the Customer keeps records about in Trackabeast: adopters and adoption applicants; foster carers; volunteers and volunteer applicants; people surrendering or finding animals; donors; veterinarians and other contacts; and the Customer's own staff and volunteers who use Trackabeast |
|---|---|
| Categories of personal data | Names; postal addresses; email addresses; phone numbers; answers to the Customer's application forms (for example household, housing, other pets and references); placement, foster and adoption history; notes and communication logs; uploaded documents such as signed contracts; photos; microchip registration details |
| Special categories | None intended. Free-text fields and uploaded documents could contain them if the Customer chooses to record them |
| Frequency of transfer | Continuous, while the Customer uses Trackabeast |
| Nature of processing | Hosting, storage, organisation, retrieval, display, export, emailing, deletion, and sending data to integrations the Customer turns on |
| Purpose | Providing the Trackabeast animal rescue management service to the Customer, including support and security |
| Duration | The term of the Service Agreement plus the 90-day period in section 8 |
| Sub-processor transfers | As listed in Annex III, for the same purposes and duration |
| Encryption in transit | All access to Trackabeast uses HTTPS |
|---|---|
| Passwords | Stored only as salted PBKDF2 hashes, never in readable form. Password resets use a one-time emailed link |
| Access control | Each organisation's users can see only that organisation's data. Every request to the file and data services is checked against a signed, time-limited login token |
| Support access | Trackabeast staff sign in to a customer account only to give support, and each such sign-in is logged |
| Documents | Uploaded documents are kept in private storage and opened only through links that expire within minutes |
| Photos | Animal photos are kept in separate storage so they can be shown on public adoption listings |
| Least privilege | Separate database accounts for test and live systems, and storage and email keys limited to only the access they need |
| Activity logging | Changes to records and logins are recorded in an activity log |
| Backups and recovery | Automated database backups are kept for 30 days. File storage keeps earlier versions for 30 days to recover from mistakes |
| Retention | Server logs are kept for 90 days. Customer data is deleted 90 days after an account closes (section 8) |
| Hosting | Amazon Web Services data centres in the United States, which hold recognised security certifications |
| Breach response | Incidents are investigated and contained, and customers are notified as in section 7 |
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, file storage, sending email (Amazon SES) | United States | EU-U.S. Data Privacy Framework and SCCs in the AWS Data Processing Addendum |
| Microsoft Corporation (Microsoft 365) | Trackabeast's own email, including support emails that may contain Customer Personal Data | United States | EU-U.S. Data Privacy Framework and SCCs in the Microsoft Products and Services Data Protection Addendum |